Storing JWT access token in a Cookie
July 10, 2018 - Søren Alsbjerg HørupI am using JWT access tokens for my latest ASP.NET Core project. Authentication is added in ConfigureServices:
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,
ValidateIssuerSigningKey = true,
ValidIssuer = Configuration\["Jwt:Issuer"\],
ValidAudience = Configuration\["Jwt:Issuer"\],
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration\["Jwt:Key"\]))
};
});This works well for my SPA application, where I store the access token in localStorage (which is bad). Moving the JWT access token to a cookie is a better approach, however I want the ability to use JWT Bearer for my APIs. Configuration of Dual authentication where:
- JWT token can be passed as part of Authorization header
- And JWT token can be passed as a token.
has proven cumbersome to implement.
A simple approach is to 1. add an access token cookie when forming the token and to 2. fake the Authorization header on the server if an access token is received as a cookie.
In the TokenController, the Cookie is either set or deleted depending on the success of the authorization:
[HttpPost]
public IActionResult Post(\[FromBody\]UserBody user)
{
IActionResult response = Unauthorized();
if (this.Authenticate(user))
{
var token = this.BuildToken(user);
response = Ok(new { token = token });
Response.Cookies.Append("access\_token", token);
}
else
{
Response.Cookies.Delete("access\_token");
}
return response;
}When a client sends his credentials, the credentials are checked and if successful a token is returned as part of the response. In addition, the token is added to an access_token cookie (which should be httpOnly for security reasons).
To make use of the cookie, we simply forge the Authorization header based upon the value of the cookie. This is done by writing a simple middleware before the app.UseAuthentication() in Startup.Configure.
app.Use(async (context, next)=>
{
var token = context.Request.Cookies\["access\_token"\];
if (token != null)
context.Request.Headers\["Authorization"\] = "Bearer " + token.ToString();
await next();
});app.UseAuthentication();
If the cookie exists, it is added to the Authorization header, thus invoking the JWT Bearer authorization mechanism in the pipeline. If the authorization fails in the pipeline, the Cookie is cleared.
Simple as that!